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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims 

Claim 1 (currently amended): A method of organizing web log data prior to storing the web log 
data, said method comprising: 

accessing configuration information associated with the web log data to bo stored , said 
configuration information including at least one expression for defining a plurality of log files 
and defining a log cut interval ; 

creating and opening a t least one web log file based on the configuration information, 
wherein the web log file is one of the defined plurality of log files ; 

creating and opening an error log file based on the configuration information, wherein the 
error log file is one of the defined plurality of log files, said error log being different than the 
web log file; 

receiving the web log data to bo stored from a web server, said wob log data including at 
l e ast on e condition associat e d th e rewith, said condition affecting storage of the r e c e iv e d w e b log 
data; said received web log data being in a format defined by the web server; 

evaluating the expression from the accessed configuration information, said evaluation 
occurring basod on tho condition associated with tho rocoivod wob log data, whoroin tho 
oxprossion spocifios ono or moro oporations for organizing tho rocoivod of the received web log 
data occurring prior to the storing of the web log data; and 

storing at least a first portion of the received web log data in the opened web log file in 
accordance with the evaluated expression evaluated basod on tho condition associated with the 
rocoivod data wob log data without modifying the format of the received web log data defined by 
the web server, wherein the opened web log file is closed and a new web log file is created and 
opened based on the log cut interval evaluated expression yields a condition associated with the 
stored first portion of the received web log data; and 

storing a second portion of the received web log data in the opened error log file without 
modifying the format of the received web log data defined by the web server, wherein the 
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evaluated expression does not yield the condition associated with the stored second portion of the 



received web log data . 



Claim 2 (previously presented): The method of claim 1, further comprising formatting the web 
log data in accordance with the accessed configuration information prior to storing the web log 
data. 

Claim 3 (previously presented): The method of claim 1, wherein receiving the web log data 
comprises receiving clickstream web log data and the condition associated therewith from a web 
server, and further comprising dividing the received clickstream web log data into a plurality of 
portions based on the expression evaluated based on the received condition. 

Claim 4 (canceled). 

Claim 5 (original): The method of claim 1, further comprising receiving the configuration 
information from a user. 

Claim 6 (original): The method of claim 1, wherein accessing the configuration information 
comprises reading configuration information from a central hierarchical database. 

Claim 7 (original): The method of claim 1, further comprising maintaining a history of evaluated 
expressions to track a sequence of the evaluated expressions. 

Claim 8 (previously presented): The method of claim 7, wherein the web log data is received 
from a computing device, and wherein maintaining the history comprises storing a cookie 
associated with the computing device, said cookie including the sequence of the evaluated 
expressions. 

Claim 9 (original): The method of claim 1, wherein evaluating the expression comprises 
recursively evaluating portions of the expression using the condition. 
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Claim 10 (previously presented): The method of claim 1, wherein the web log data is received 
from a computing device and further comprising: 

authenticating the computing device; and 

opening a plurality of files to store the received web log data. 

Claim 1 1 (previously presented): The method of claim 1, wherein storing the received web log 
data comprises: 

preparing column web log data responsive to the received web log data and the evaluated 
expression; and 

storing the prepared column web log data in a file. 

Claim 12 (previously presented): The method of claim 1 , wherein evaluating the expression 
comprises: 

forwarding the received web log data to a filter component to evaluate the expression 
using the condition; and 

receiving the evaluated expression from the filter component. 

Claim 13 (previously presented): The method of claim 1, further comprising sampling the 
received web log data prior to storing the received web log data. 

Claim 14 (previously presented): The method of claim 1, wherein said receiving the web log 
data and said evaluating the expression occur in real-time. 

Claim 15 (previously presented): One or more computer storage media having computer- 
executable instructions for performing the method recited in claim 1 . 

Claim 16 (currently amended): One or more computer storage media having computer- 
executable components for filtering web log data prior to storing the web log data, said 
components comprising: 
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a configuration component to access configuration information associated with the web 
log data to be stored , said configuration information including at least one expression; 

an interface component to receive web log data to be stored from a web server, said web 
log data including at least one condition, said condition being associated with the web log data 
and affecting storage thereof, said received web log data being in a format defined by a web 
server; 

an expression component to evaluate the expression accessed by the configuration 
component based on the condition received by the interface component, wherein the expression 
specifies one or more operations for organizing the received web log; and 

a storage component to store the at least a portion of the received web log data received 
by the interface component in accordance with the expression evaluated by the expression 
component without modifying the format of the received web log data defined by the web server; 
and 

a logging component for storing a cookie associated with a computing device, said cookie 
including a sequence of evaluated expressions for maintaining a history of the evaluated 
expressions to track the sequence of the evaluated expressions, wherein the web log data is 
received from the computing device . 

Claim 17 (previously presented): The computer storage media of claim 16, wherein the 
configuration component, when executed, creates structured web log data with enumerated 
values associated therewith based on the received configuration information. 

Claim 18 (previously presented): The computer storage media of claim 16, further comprising a 
helper component to parse the web log data received by the interface component for use by the 
expression component. 

Claim 19 (previously presented): The computer storage media of claim 16, further comprising 
an authentication component to obtain user information associated with the web log data 
received by the interface component. 
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Claim 20 (previously presented): The computer storage media of claim 16, further comprising a 
scheduling component to create a file for use by the storage component to store the received web 
log data. 

Claim 21 (currently amended): A system for organizing web log data prior to storing the web 
log data, said system comprising: 

a memory area to store configuration information associated with the web log data to-be 
stored , said configuration information including at least one expression and defining a log cut 
interval wherein the expression specifies one or more operations for organizing the received web 
log data and the log cut interval specifies a maximum size for a web log file ; 

a computing device to process the web log data, said web log data including at least one 
condition associated therewith, said condition affecting storage of the web log data, said received 
web log data being in a format defined by a web serve r, wherein the computing device creates 
and opens the web log file ; and 




a computer storage medium storing computer-executable instructions to be executed on 
the computing device to evaluate the expression from the configuration information stored in the 
memory area, said computing device evaluating the expression based on the condition associated 
with the web log data prior to the storing of the web log data and to store storing at least a 
portion of the received web log data in accordance with the evaluated expression without 
modifying the format of the received web log data defined by the web serve r, said computing 
device closing the opened web log file and creating and opening a new web log file based on the 
log cut interval, wherein additional portions of the web log data subsequently received from the 
web server are stored in the new web log file . 

Claim 22 (previously presented): The system of claim 21, further comprising a web server to 
generate the web log data. 




Claim 23 (previously presented): The system of claim 22, further comprising another computing 
device to receive the web log data from the web server. 
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Claim 24 (previously presented): The system of claim 21, further comprising another memory 
area to store the web log data in a plurality of files in accordance with the configuration 
information. 

Claim 25 (previously presented): The system of claim 21, wherein the computer storage medium 
stores computer-executable instructions to be executed on the computing device in real-time to 
receive the web log data and to filter the received web log data prior to storage of the web log 
data by evaluating the expression using the received web log data. 



Claim 26-34 (canceled). 



